Risk Analyst

Location: Toronto, ON

Onsite Flexibility

Hybrid — 4 days in office, 1 day work from home

Contract Details

- Position Type: Contract
- Contract Duration: 10 months (with possibility of extension and conversion based on business needs and performance)
- Pay Rate: C$60.00–C$70.00 / Hour (CAD)
- Shift / Schedule: Monday–Friday, core business hours, 37.5 hours per week, 7.5 hours per day
- Travel Requirements: Not required

Job Summary

This Risk Analyst role sits within Enterprise Procurement and focuses on supplier risk and security. The position is net new and will operate within a team of approximately 80 people. The successful contractor will undergo TD onboarding and a knowledge-transfer period before hitting the ground running. The role involves significant stakeholder engagement — approximately six hours per day in meetings on average — coordinating internally across Procurement, Security, Legal, and Technology Risk. The contractor will not have access to any customer data.

Key Responsibilities

A. Supplier Security Schedule Review and Negotiation

- Review supplier redlines, exceptions, proposed substitutions and qualification language affecting security obligations.
- Assess whether proposed alternative controls provide comparable protection, taking account of the supplier's services, delivery model, data access, hosting arrangements and risk profile.
- Translate technical security requirements into clear contractual implications and practical negotiation recommendations for Procurement.
- Support sourcing and contract managers in supplier discussions, including explaining requirements,



documenting rationale and proposing acceptable wording within approved positions.
- Identify changes that weaken, qualify, narrow or remove security obligations and distinguish routine drafting issues from substantive control or risk changes.

B. Financial Services and Third-Party Risk Advisory

- Apply knowledge of the organization's security policies, third-party risk framework and applicable financial-services regulatory expectations, including relevant OSFI requirements, as directed by internal control owners.
- Consider supplier access to information, systems, environments and services, including cloud, SaaS, outsourcing and other technology-enabled arrangements.
- Identify when a supplier proposal may affect incident notification, audit and assurance, access controls, data protection, subcontracting, resilience, business continuity or termination/exit obligations.
- Support alignment between contractual security requirements and the supplier risk assessment and control-assessment process.

C. Stakeholder Coordination and Escalation

- Act as Procurement's primary point of contact for supplier security-contracting questions and coordinate input from Security, Legal and Technology Risk.
- Resolve matters that fall within approved playbooks and delegated authority; elevate material deviations,



policy exceptions and risk acceptance decisions to the designated owners.
- Prepare concise decision papers identifying the proposed change, relevant standard, risk implication, options, recommendation and required approver.
- Maintain an audit trail of advice, approvals, deviations and final negotiated positions.

D. Playbooks and Process

- Help maintain security-contracting playbooks, clause guidance, fallback language, negotiation matrices and escalation thresholds.
- Identify recurring supplier objections and recommend improvements to standard clauses, guidance and sourcing processes.
- Provide training and practical guidance to sourcing managers and contract managers on security clause interpretation and escalation procedures.

Initial Contracting Scope

The position would initially focus on supplier amendments to the following provisions identified for this business case. The advisor should validate clause-specific requirements against the current approved agreement templates, standards and playbooks before providing negotiation advice.

Security Controls

- Review supplier redlines to detailed security controls, including proposed alternative controls, qualifications, exclusions and requests to reduce or remove obligations. Assess contractual and control implications and recommend positions consistent with approved security requirements.

Public Cloud Provider

- Review supplier changes relating to public-cloud delivery and associated security obligations. Coordinate assessment of cloud-specific concerns and identify changes requiring input or a

📌 Risk Analyst (Toronto)
🏢 Global-Technical-Talent-1
📍 Toronto